Network authentication method, and related device and system
This application discloses a network authentication method, and a related device and system. The method includes: receiving, by a network authentication network element, an access request sent by user equipment, where the access request includes identification information of the user equipment; verifying, by the network authentication network element, whether the identification information is valid, and if the identification information is valid, determining, based on the identification information, a slice authentication network element corresponding to the user equipment; and sending, by the network authentication network element, the identification information to the slice authentication network element corresponding to the user equipment, where the identification information is used by the slice authentication network element corresponding to the user equipment to generate authentication data for the user equipment and initiate a user authentication request to the user equipment by using the authentication data.
1. A network authentication system, comprising:
a base station;
a mobility management network element; and
a slice authentication network element, wherein:
the base station is configured to receive an access request carrying a first identifier from a user equipment (UE) and send the access request to the mobility management network element;
the mobility management network element is configured to receive the access request;
the mobility management network element is further configured to send, based on the first identifier being valid, a second identifier to the slice authentication network element corresponding to the UE;
the slice authentication network element is configured to receive the second identifier and send a first user authentication message to the UE based on the second identifier, wherein the first user authentication message comprises a first identifier and a slice identifier; and
the slice authentication network element is configured to receive a second user authentication message from the UE in response to the first user authentication message.
2. The network authentication system according to claim 1 , wherein the first identifier comprises identification information of the UE in an operator network.
3. The network authentication system according to claim 1 , wherein the second identifier comprises identification information of the UE for network slice authentication.
4. The network authentication system according to claim 1 , wherein the second identifier comprises at least one of a physical identifier and a service identifier of the UE.
5. The network authentication system according to claim 1 , wherein the slice authentication network element corresponding to the UE is determined based on the first identifier.
6. The network authentication system according to claim 1 , wherein the mobility management network element is further configured to send, based on the first identifier being valid, the first identifier to the slice authentication network element corresponding to the UE; and
the slice authentication network element is configured to send the first user authentication message to the UE based on the first identifier and the second identifier.
7. The network authentication system according to claim 1 , wherein the first identifier being valid is by virtue of the security context of the UE identified by the first identifier being valid.
8. The network authentication system according to claim 1 , wherein the first identifier being valid is by virtue of the UE identified by the first identifier being not deregistered.
9. A network authentication method, comprising:
receiving, by a base station, an access request from a user equipment (UE), the access request carrying a first identifier;
sending, by the base station, the access request to a mobility management network element;
receiving, by the mobility management network element, the access request;
sending, by the mobility management network element, based on the first identifier being valid, a second identifier to a slice authentication network element corresponding to the UE;
receiving, by the slice authentication network element, the second identifier;
sending a first user authentication message to the UE based on the second identifier, wherein the first user authentication message comprises a first identifier and a slice identifier; and
receiving, by the slice authentication network element, a second user authentication message from the UE.
10. The network authentication method according to claim 9 , wherein the first identifier comprises identification information of the UE in an operator network.
11. The network authentication method according to claim 9 , wherein the second identifier comprises identification information of the UE for network slice authentication.
12. The network authentication method according to claim 9 , wherein the second identifier comprises at least one of a physical identifier and a service identifier of the UE.
13. The network authentication method according to claim 9 , wherein the slice authentication network element corresponding to the UE is determined based on the first identifier.
14. The network authentication method according to claim 9 , further comprising:
sending, by the mobility management network element, based on the first identifier being valid, the first identifier to the slice authentication network element corresponding to the UE; and
sending, the first user authentication message to the UE based on the second identifier comprises:
sending, by the slice authentication network element, the first user authentication message to the UE based on the first identifier and the second identifier.
15. The network authentication method according to claim 9 , wherein the first identifier being valid is by virtue of the security context of the UE identified by the first identifier being valid.
16. The network authentication method according to claim 9 , wherein the first identifier being valid comprises: the UE identified by the first identifier being not deregistered.